Privacy policy

Malm Wealth Oy is the controller of personal data processed through this website, malmhq.com. In plain words: we decide why and how your data is used, and we are responsible for it.

• Company: Malm Wealth Oy, a Finnish limited liability company (osakeyhtiö)
• Business ID: 3647580-9
• VAT number: FI36475809
• Registered in the Finnish Trade Register, kept by the Finnish Patent and Registration Office
• Domicile: Espoo, Finland
• Email, also for all privacy requests: hello@malmhq.com

We have not appointed a data protection officer, because the law does not require one for what we do.

This policy covers the Malm website, including the Baki evaluations published on it. It does not cover other websites that we link to. Their owners have their own policies.

The site has no user accounts, no payments and no newsletter. The only form on the site asks for an email address so you can request an evaluation.

Visiting the site

• What: technical data such as your IP address, browser type, the page you asked for and the time. Our host, Cloudflare, processes it.
• Why: to deliver the site, keep it secure and fix faults.
• Legal basis: our legitimate interest in running and securing the site.
• How long: request logs stay in our Cloudflare account for a short period.

Logos on evaluation pages

• What: evaluation pages load each product's logo from the logo address in its evaluation report. That address can belong to a third party, whose server then sees your IP address and browser details.
• Why: to show which product an evaluation is about.
• Legal basis: our legitimate interest in showing evaluations.
• Your choice: this happens whatever you choose in Cookie settings, because the logo is part of the page. We do not control how those third parties keep data.

Requesting an evaluation

• What: only your email address. We store it through Clerk.
• Why: to handle your request and reply to you. We, or Clerk on our behalf, may email you about it.
• Legal basis: taking steps at your request, and our legitimate interest in answering it.
• Required?: no. Without an email address we cannot reply to a request.
• How long: see How long we keep data.

Analytics (only with your consent)

• What: with Google Analytics and PostHog, page views, interactions with the page such as clicks, error reports, and device, browser and approximate location details.
• Why: to see which pages are used and which errors occur.
• Legal basis: your consent. If you reject, neither tool loads.
• Not done: we do not record sessions, and we do not identify visitors or build profiles of named people.

Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects.

We store information on your device only as listed below. Necessary and functional items need no consent. Analytics items are set only after you accept analytics.

To change your choice at any time, use Cookie settings in the footer of any page. If you reject analytics or withdraw consent, Google Analytics and PostHog stop loading and we delete their cookies.

Questions about cookies: hello@malmhq.com.

We do not sell personal data. We use these providers to run the site.

• Cloudflare, Inc.: hosting, security and request logs.
• Clerk, Inc.: stores the email addresses of evaluation requests.
• Google Ireland Limited and Google LLC: Google Analytics, only if you accept analytics.
• PostHog: product analytics on its EU cloud, only if you accept analytics.
• Third-party logo hosts: see Logos on evaluation pages above. They are not our processors.

We may also disclose data if the law or an authority requires it.

• Evaluation data is kept in Cloudflare R2 in the Western Europe region.
• Evaluation request emails are kept in Clerk and stored in the EU.
• Analytics data in PostHog is stored in PostHog's EU cloud.
• Request logs are processed by Cloudflare, which serves the site from locations around the world.

Some of our providers (Cloudflare, Google and Clerk as companies) may process data outside the EU/EEA, including in the United States. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified under it. Otherwise they rely on the standard contractual clauses approved by the European Commission.

• Evaluation request emails: until the request has been handled, and for at most 12 months after our last contact with you. Then we delete them, unless a customer relationship has started.
• Request logs: for a short period in our Cloudflare account.
• Cookie choice (cc_cookie): 182 days in your browser.
• Analytics data: at most 14 months in Google Analytics and PostHog.

Under the GDPR you have the right to:

• access your data and get a copy
• have wrong data corrected
• have your data erased
• restrict how we use it
• object to processing based on our legitimate interest
• receive data you gave us in a portable format
• withdraw consent at any time, using Cookie settings in the footer. Withdrawing does not affect earlier processing.

To use a right, email hello@malmhq.com. We reply within one month. We may ask you to confirm who you are.

You can also complain to the supervisory authority: the Office of the Data Protection Ombudsman, Finland (tietosuoja.fi).

The site is not directed at children under 16, and we do not knowingly collect their data. If you think a child has sent us their email address, write to us and we will delete it.

We update this policy when our practices change. The date at the top shows the latest version. If a change is significant, we will say so on the site.

• Malm Wealth Oy, Business ID 3647580-9, Espoo, Finland
• Email, for privacy and security questions: hello@malmhq.com

• Terms of service
• Security
• Cookie settings: use the Cookie settings link in the footer of any page.